---
typeId: req
recordId: benac-sec-001
fields:
  title: Host-mediated secrets and authentication credentials
  statement: Secrets and authentication credentials shall be mediated by the Host
    Station. Packages and agents shall not receive raw secret material by
    default; they may request approved operations that use secret references
    under policy.
  rationale: Benac must support authentication to external services without making
    long-lived credentials package-readable.
  verification: Invoke a package requiring API authentication and inspect
    evidence/effects to confirm secret reference use, redaction, and absence of
    raw secret exposure.
  testable: true
  status: draft
  area: BENAC-SEC
  sourceDocument: /home/johnb/Downloads/benac_syrs_v0_4_integrated_authentication.md
  sourceVersion: v0.4
  sourceSections:
    - 10.13 Secrets, protected local state, and redaction
  order: 148
---
